{"id":"CVE-2024-38612","state":"PUBLISHED","title":"ipv6: sr: fix invalid unregister error path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: fix invalid unregister error path\n\nThe error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL\nis not defined. In that case if seg6_hmac_init() fails, the\ngenl_unregister_family() isn't called.\n\nThis issue exist since commit 46738b1317e1 (\"ipv6: sr: add option to control\nlwtunnel support\"), and commit 5559cea2d5aa (\"ipv6: sr: fix possible\nuse-after-free and null-ptr-deref\") replaced unregister_pernet_subsys()\nwith genl_unregister_family() in this error path.","publishedAt":"2024-06-19T13:56:13.415Z","updatedAt":"2026-10-15T00:43:39.292Z","severity":{"score":7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"46738b1317e169b281ad74690276916e24d1be6d","status":"affected","lessThan":"10610575a3ac2a702bf5c57aa931beaf847949c7","versionType":"git"},{"version":"46738b1317e169b281ad74690276916e24d1be6d","status":"affected","lessThan":"646cd236c55e2cb5f146fc41bbe4034c4af5b2a4","versionType":"git"},{"version":"46738b1317e169b281ad74690276916e24d1be6d","status":"affected","lessThan":"00e6335329f23ac6cf3105931691674e28bc598c","versionType":"git"},{"version":"46738b1317e169b281ad74690276916e24d1be6d","status":"affected","lessThan":"1a63730fb315bb1bab97edd69ff58ad45e04bb01","versionType":"git"},{"version":"46738b1317e169b281ad74690276916e24d1be6d","status":"affected","lessThan":"e77a3ec7ada84543e75722a1283785a6544de925","versionType":"git"},{"version":"46738b1317e169b281ad74690276916e24d1be6d","status":"affected","lessThan":"3398a40dccb88d3a7eef378247a023a78472db66","versionType":"git"},{"version":"46738b1317e169b281ad74690276916e24d1be6d","status":"affected","lessThan":"85a70ff1e572160f1eeb096ed48d09a1c9d4d89a","versionType":"git"},{"version":"46738b1317e169b281ad74690276916e24d1be6d","status":"affected","lessThan":"c04d6a914e890ccea4a9d11233009a2ee7978bf4","versionType":"git"},{"version":"46738b1317e169b281ad74690276916e24d1be6d","status":"affected","lessThan":"160e9d2752181fcf18c662e74022d77d3164cd45","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv6/seg6.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.10","versionType":"semver"},{"version":"4.19.316","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.278","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.219","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.161","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.93","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.33","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.8.12","status":"unaffected","lessThanOrEqual":"6.8.*","versionType":"semver"},{"version":"6.9.3","status":"unaffected","lessThanOrEqual":"6.9.*","versionType":"semver"},{"version":"6.10","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv6/seg6.c"]}],"references":["https://git.kernel.org/stable/c/10610575a3ac2a702bf5c57aa931beaf847949c7","https://git.kernel.org/stable/c/646cd236c55e2cb5f146fc41bbe4034c4af5b2a4","https://git.kernel.org/stable/c/00e6335329f23ac6cf3105931691674e28bc598c","https://git.kernel.org/stable/c/1a63730fb315bb1bab97edd69ff58ad45e04bb01","https://git.kernel.org/stable/c/e77a3ec7ada84543e75722a1283785a6544de925","https://git.kernel.org/stable/c/3398a40dccb88d3a7eef378247a023a78472db66","https://git.kernel.org/stable/c/85a70ff1e572160f1eeb096ed48d09a1c9d4d89a","https://git.kernel.org/stable/c/c04d6a914e890ccea4a9d11233009a2ee7978bf4","https://git.kernel.org/stable/c/160e9d2752181fcf18c662e74022d77d3164cd45","https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-613116.html"],"weaknesses":["CWE-476","CWE-416"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/38xxx/CVE-2024-38612.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-38612","state":"PUBLISHED","datePublished":"2024-06-19T13:56:13.415Z","dateUpdated":"2026-10-15T00:43:39.292Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-06-18T19:36:34.944Z"},"containers":{"cna":{"title":"ipv6: sr: fix invalid unregister error path","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: fix invalid unregister error path\n\nThe error path of seg6_init() is wrong in case CONFIG_IPV6_SEG6_LWTUNNEL\nis not defined. In that case if seg6_hmac_init() fails, the\ngenl_unregister_family() isn't called.\n\nThis issue exist since commit 46738b1317e1 (\"ipv6: sr: add option to control\nlwtunnel support\"), and commit 5559cea2d5aa (\"ipv6: sr: fix possible\nuse-after-free and null-ptr-deref\") replaced unregister_pernet_subsys()\nwith genl_unregister_family() in this error path."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"46738b1317e169b281ad74690276916e24d1be6d","status":"affected","lessThan":"10610575a3ac2a702bf5c57aa931beaf847949c7","versionType":"git"},{"version":"46738b1317e169b281ad74690276916e24d1be6d","status":"affected","lessThan":"646cd236c55e2cb5f146fc41bbe4034c4af5b2a4","versionType":"git"},{"version":"46738b1317e169b281ad74690276916e24d1be6d","status":"affected","lessThan":"00e6335329f23ac6cf3105931691674e28bc598c","versionType":"git"},{"version":"46738b1317e169b281ad74690276916e24d1be6d","status":"affected","lessThan":"1a63730fb315bb1bab97edd69ff58ad45e04bb01","versionType":"git"},{"version":"46738b1317e169b281ad74690276916e24d1be6d","status":"affected","lessThan":"e77a3ec7ada84543e75722a1283785a6544de925","versionType":"git"},{"version":"46738b1317e169b281ad74690276916e24d1be6d","status":"affected","lessThan":"3398a40dccb88d3a7eef378247a023a78472db66","versionType":"git"},{"version":"46738b1317e169b281ad74690276916e24d1be6d","status":"affected","lessThan":"85a70ff1e572160f1eeb096ed48d09a1c9d4d89a","versionType":"git"},{"version":"46738b1317e169b281ad74690276916e24d1be6d","status":"affected","lessThan":"c04d6a914e890ccea4a9d11233009a2ee7978bf4","versionType":"git"},{"version":"46738b1317e169b281ad74690276916e24d1be6d","status":"affected","lessThan":"160e9d2752181fcf18c662e74022d77d3164cd45","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv6/seg6.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.10","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.10","versionType":"semver"},{"version":"4.19.316","status":"unaffected","lessThanOrEqual":"4.19.*","versionType":"semver"},{"version":"5.4.278","status":"unaffected","lessThanOrEqual":"5.4.*","versionType":"semver"},{"version":"5.10.219","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.161","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.93","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.33","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.8.12","status":"unaffected","lessThanOrEqual":"6.8.*","versionType":"semver"},{"version":"6.9.3","status":"unaffected","lessThanOrEqual":"6.9.*","versionType":"semver"},{"version":"6.10","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv6/seg6.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/10610575a3ac2a702bf5c57aa931beaf847949c7"},{"url":"https://git.kernel.org/stable/c/646cd236c55e2cb5f146fc41bbe4034c4af5b2a4"},{"url":"https://git.kernel.org/stable/c/00e6335329f23ac6cf3105931691674e28bc598c"},{"url":"https://git.kernel.org/stable/c/1a63730fb315bb1bab97edd69ff58ad45e04bb01"},{"url":"https://git.kernel.org/stable/c/e77a3ec7ada84543e75722a1283785a6544de925"},{"url":"https://git.kernel.org/stable/c/3398a40dccb88d3a7eef378247a023a78472db66"},{"url":"https://git.kernel.org/stable/c/85a70ff1e572160f1eeb096ed48d09a1c9d4d89a"},{"url":"https://git.kernel.org/stable/c/c04d6a914e890ccea4a9d11233009a2ee7978bf4"},{"url":"https://git.kernel.org/stable/c/160e9d2752181fcf18c662e74022d77d3164cd45"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The leaked `seg6_genl_family` is reached through generic netlink sockets (`nlctrl` family enumeration or `SEG6_CMD_*` messages), which require local system access. No remote packet path reaches the stale registration.\nAC:H - The corrupt state only arises if `seg6_hmac_init()` fails during one-shot module/boot init (an ENOMEM or missing-crypto condition an attacker cannot reliably force), and only on the uncommon `CONFIG_IPV6_SEG6_HMAC=y` with `CONFIG_IPV6_SEG6_LWTUNNEL=n` configuration, since distros that enable HMAC normally also enable LWTUNNEL.\nPR:L - Once the family is leaked, any unprivileged local user can dereference the stale `struct genl_family` via `CTRL_CMD_GETFAMILY`/dump on `nlctrl`, which carries no capability check; in the module case even the `GENL_ADMIN_PERM` flag is read out of the freed memory, so the privilege gate itself is unreliable.\nUI:N - Exploitation needs only the attacker's own netlink socket operations after the failed init; no victim action is involved.\nS:U - The dangling family struct, freed pernet data, and any resulting code execution all remain within the kernel's own security authority — no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `CTRL_CMD_GETFAMILY` copies `name`, `version`, `maxattr`, and the op list out of the freed module region into a netlink reply, and `SEG6_CMD_GET_TUNSRC` returns data read through the freed `seg6_pernet_data`, disclosing reclaimed kernel memory to userspace.\nI:H - The use-after-free supplies write primitives — `SEG6_CMD_SET_TUNSRC` writes an attacker-supplied IPv6 address into freed memory and `SEG6_CMD_SETHMAC` mutates a freed rhashtable — while the stale `family->ops[].doit`/`pre_doit` pointers in freed module memory offer control-flow hijack.\nA:H - Dereferencing the freed family struct or the dangling `net->ipv6.seg6_data` produces a use-after-free oops, and netns created after the failure yield a NULL-pointer dereference, either of which panics the kernel."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T11:33:11.285Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"4.19.316"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"5.4.278"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"5.10.219"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"5.15.161"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.1.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.6.33"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.8.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.9.3"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.10","versionEndExcluding":"6.10"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"46738b1317e1","status":"affected","lessThan":"0610575a3ac","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"46738b1317e1","status":"affected","lessThan":"646cd236c55e","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"46738b1317e1","status":"affected","lessThan":"00e6335329f2","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"46738b1317e1","status":"affected","lessThan":"1a63730fb315","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"46738b1317e1","status":"affected","lessThan":"e77a3ec7ada8","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"46738b1317e1","status":"affected","lessThan":"3398a40dccb8","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"46738b1317e1","status":"affected","lessThan":"85a70ff1e572","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"46738b1317e1","status":"affected","lessThan":"c04d6a914e89","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"46738b1317e1","status":"affected","lessThan":"160e9d275218","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"4.10","status":"affected"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"0","status":"unaffected","lessThan":"4.10","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"4.19.316","status":"unaffected","lessThanOrEqual":"4.20","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"5.4.278","status":"unaffected","lessThanOrEqual":"5.5","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"acrn","defaultStatus":"unknown","versions":[{"version":"5.10.219","status":"unaffected","lessThanOrEqual":"5.11","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:acrn:*:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"5.15.161","status":"unaffected","lessThanOrEqual":"5.16","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"6.1.93","status":"unaffected","lessThanOrEqual":"6.2","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"6.6.33","status":"unaffected","lessThanOrEqual":"6.7","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"6.8.12","status":"unaffected","lessThanOrEqual":"6.9","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"6.9.3","status":"unaffected","lessThanOrEqual":"6.10","versionType":"custom"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]},{"vendor":"linux","product":"linux_kernel","defaultStatus":"unknown","versions":[{"version":"6.10-rc1","status":"unaffected"}],"cpes":["cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-06-25T14:07:52.263547Z","id":"CVE-2024-38612","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-476","type":"CWE","lang":"en","description":"CWE-476 NULL Pointer Dereference"}]},{"descriptions":[{"cweId":"CWE-416","type":"CWE","lang":"en","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-25T14:37:58.950Z"}},{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/10610575a3ac2a702bf5c57aa931beaf847949c7","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/646cd236c55e2cb5f146fc41bbe4034c4af5b2a4","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/00e6335329f23ac6cf3105931691674e28bc598c","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/1a63730fb315bb1bab97edd69ff58ad45e04bb01","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/e77a3ec7ada84543e75722a1283785a6544de925","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/3398a40dccb88d3a7eef378247a023a78472db66","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/85a70ff1e572160f1eeb096ed48d09a1c9d4d89a","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/c04d6a914e890ccea4a9d11233009a2ee7978bf4","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/160e9d2752181fcf18c662e74022d77d3164cd45","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2025-11-04T17:21:46.235Z"}},{"affected":[{"vendor":"Siemens","product":"RUGGEDCOM RST2428P","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V3.1","versionType":"custom"}]},{"vendor":"Siemens","product":"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family","defaultStatus":"unknown","versions":[{"version":"0","status":"unaffected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SCALANCE XCM-/XRM-/XCH-/XRH-300 family","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V3.1","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThan":"V1.1.1","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.0","status":"affected","lessThan":"V3.1.5","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-613116.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T00:43:39.292Z"},"x_adpType":"supplier"}]}}}